The exposure
Many small systems, one adversary.
Building automation, traffic control, transit signaling and public works SCADA are often maintained by a single integrator with standing remote access. The blast radius is a city.
CISA CPGNIST CSFState CIP
■Integrator remote access is the most common path in
■Asset inventories rarely exist below the IT boundary
■Grant-funded upgrades need a security scope written in
Typical topologyExposed path
L3.5 · DMZJump host
VENDOR VPN
L2 · HMIOps center HMI
L2 · SCADAFacility SCADA
L2 · HISTORIANTrend historian
L1 · PLCBAS controllers
L1 · RTUTraffic / signal RTU
L1 · SAFETYLife-safety
L0 · PROCESSPumps · HVAC · signals · gates
Where we start
